Diagnose push notification error

In an ejected app, using ExponentToken and sendPushNotificationsAsync on Android push notifications work fine. but iOS we are having issues with - expo knows about our APN, but complains when actually sending.

I can confirm expo credentials:manager shows our only Push Key is assigned to the right owner/slug. I can confirm expo fetch:ios:certs also pulls the right key and team, include the right p8 file.

expo credentials:manager -p ios:

Accessing credentials for REDACTED in project REDACTED
Available credentials for iOS apps

Application credentials

  Experience: @ REDACTED/REDACTED, bundle identifier: REDACTED
    Provisioning profile (ID: REDACTED)
    Apple Team ID: REDACTED,  Apple Team Name: REDACTED (Company/Organization)


User credentials

  Distribution Certificate - Certificate ID: REDACTED
    Apple Team ID: REDACTED,  Apple Team Name: REDACTED (Company/Organization)
    used by
      @REDACTED/REDACTED (REDACTED)

  Push Notifications Key - Key ID: REDACTED
    Apple Team ID: REDACTED,  Apple Team Name: REDACTED (Company/Organization)
    used by
      @REDACTED/REDACTED (REDACTED)

expo fetch:ios:certs:

These credentials are associated with Apple Team ID: REDACTED
Wrote distribution cert credentials to disk.
Wrote push key credentials to disk.
Wrote provisioning profile to disk
Save these important values as well:
 
Distribution P12 password: REDACTED
Push Key ID:               REDACTED
Push P12 password:         (not available)

From the app, we can get an ExponentPushToken fine.

but trying to curl shows this error: (same error in calling sendPushNotificationsAsync - note: Android works, just not iOS)

curl -H "Content-Type: application/json" -X POST "https://exp.host/--/api/v2/push/send" -d '{
  "to": "ExponentPushToken[REDACTED]",
  "title":"hello",
  "body": "world"
}'
{"data":{"status":"error","message":"Could not find APNs credentials for REDACTED (@REDACTED/REDACTED). You may need to generate or upload new push credentials.","details":{"error":"InvalidCredentials"}}}%

I’ve confirmed that this also fails with the same error on the Expo Push Test Tool - it also says “Could not find APNs credentials for REDACTED (@REDACTED/REDACTED). You may need to generate or upload new push credentials” for any of these tokens.

To test, I also did a managed build with the same owner/slug and expo build:ios -c but no change, unfortunately - was hoping that might trick Expo to know the match.

Any thoughts?

I should add, I also have used both credentials:manager and build:ios -c (overriding the warning that it was not managed) to reset the APN keys and have expo control in hopes that fixed it, but no luck.

I can also confirm that Apple Credentials UI shows the P8 created by Expo.